CVE-2026-64277

CVE CVE-2026-64277EUVD EUVD-2026-48989Published 2026-07-25T08:49:21.000ZLast changed 2026-08-05T12:40:28.000ZCVSS 7.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127). rmi_f3a_map_gpios() then allocates gpio_key_map with min(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f3a_attention() iterates the full gpio_count and dereferences gpio_key_map[i], and input->keycodemax is set to the full gpio_count while input->keycode points at the 6-entry allocation. A device that reports gpio_count > 6 therefore causes an out-of-bounds read of gpio_key_map[] on every attention interrupt, and out-of-bounds accesses through the input core's default keymap ioctls: EVIOCGKEYCODE reads past the buffer (leaking adjacent slab memory to user space) and EVIOCSKEYCODE writes a caller-controlled value past it, for any process able to open the evdev node, since input_default_getkeycode() and input_default_setkeycode() only bound the index against keycodemax. Size the keymap for the full gpio_count. The mapping loop is unchanged: it still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END) entries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills) and are skipped when reporting.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 9e4c596bfd004f447a652205163234dfd4aafa69 <502ad7caaa1a445b734c827fa256e5311df67e3d; patch: 7.1.4; patch: 5.10.261; 9e4c596bfd004f447a652205163234dfd4aafa69 <ba57f430328534501962d60d651e385ffd7af9ca; 9e4c596bfd004f447a652205163234dfd4aafa69 <8db211aed83733073b0814adaeeab61d4521474e; 9e4c596bfd004f447a652205163234dfd4aafa69 <850117b637bcb1dcc14be0cf09ac819a8707b42c; 9e4c596bfd004f447a652205163234dfd4aafa69 <57c10915f2c16c90e0d46ad00876bf39ece40fc2; 5.10; patch: 0; 9e4c596bfd004f447a652205163234dfd4aafa69 <3480e24bc4e178aaa009edb25b6ee12df199e210; patch: 6.6.145; 9e4c596bfd004f447a652205163234dfd4aafa69 <35ed74d32d8260bdfb14a94caf402bf0866bdeec; patch: 7.2-rc1; patch: 6.1.178; patch: 5.15.212; 9e4c596bfd004f447a652205163234dfd4aafa69 <64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42; patch: 6.12.96; patch: 6.18.39

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.